To: 


Of: 


1CO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Rain Trading Limited 


Ardeifi, New Street, Lampeter, Ceredigion, United Kingdom SA48 7AL 


The Information Commissioner (“Commissioner”) has decided to issue 
Rain Trading Limited (“RTL”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is being 
issued because of a serious contravention of regulation 21 of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003. 


This notice explains the Commissioner’s decision. 


Legal framework 


RTL, whose registered office is given above (Companies House 
Registration Number: 09124867) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 
(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 
of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 
to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at any 
time, and 
(b) where such notification is withdrawn, the caller shall not make 


such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, forthe time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
set up to carry out this role. Businesses who wish to carry out direct 
marketing by telephone can subscribe to the TPS for a fee and receive 


from them monthly a list of numbers on that register. 


Section 11(3) of the DPA defines direct marketing as “the 
communication (by whatever means) of any advertising or marketing 
material which is directed to particular individuals”. This definition also 


applies for the purposes of PECR (see regulation 2(2)). 


Under section 55A (1) of the DPA (as amended by PECR 2011 and the 


Privacy and Electronic Communications (Amendment) Regulations 


Information Commissioner's Office 


2015) the Commissioner may serve a person with a monetary penalty 
notice if the Commissioner is satisfied that - 


“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003 by the person, and 


(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


10. The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


11. PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 


12. 


13. 


14. 


15. 


Information Commissioner's Office 


strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


RTL first came to the attention of the Commissioner in October 2018, 
when a particular Caller Line Identity (“CLI”) was identified in the ICO’s 
‘Monthly Threat Assessment’ as being a CLI used by one of the 
organisations responsible for generating the most complaints for that 
month via the TPS. 


The Commissioner served a Third Party Information Notice (“3PIN”) on 
the Communications Service Provider (“CSP”) for that CLI in order to 
establish the identity of its subscriber. The Commissioner also sought 
details as to any other CLIs being used by that subscriber overa 


prescribed period. 


The CSP responded to confirm that the CLI quoted belonged to RTL 
(Trading name: ‘Intelligent Home Energy’), and that between the 
period of 1 January 2018 and 29 November 2018 (the “relevant 
period”) there were 31 CLIs allocated to the organisation, but only 10 


were in use. Specifically: 


01438546103; 01727292023; 01733618107; 01799336003; 
01865659136; 01892307105; 03332125741; 03332127621; 
03332127628; 03332129316. 


16. 
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The Commissioner carried out a thorough search of the complaints 
logged against those CLIs between 1 January 2018 and 29 November 


2018 to both the TPS and the Commissioner’s Online Reporting Tool 
(“ORT”). A total of 99 complaints were logged. 


Some of the complaints received by the Commissioner, and the TPS, 


contained comments such as the following: 


"You need new loft insulation". Quite an aggressive man, refused to 
divulge the source of his ‘information’ and claimed that TPS and GDPR 


didn't apply to him.” 


“Salesperson "John" had my home address and name and claimed that 
I "qualified for loft insulation". When I asked for his comps-any [sic] 
and other details he was in quite a hurry to remove me from his call 
DB. Was aware of TPS, but claimed his "data was 15 yeas [sic] old" as 
if that didn't apply.” 


“Very concerning that this man knew our name and was prepared to 
argue back that he was above the law regarding data protection and 


cold calling.” 


“It interrupted what I was doing, it wasted my time, it busied my 
private line and prevented others from contacting me, it annoyed me 


and it raised my blood pressure...” 


“This was 25 minutes after I received another call from this company, 
who are still calling me almost daily! Both times asking for i. 
The first person actually spoke to me and I asked to be removed from 


their lists, which he said they would do! The second person hung up on 
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me when I said that I wasn't RE. This company are infuriating and 


causing a great deal of nuisance.” 


The Commissioner sent an initial investigation letter to RTL on 8 
January 2019 setting out her concerns regarding their compliance with 
PECR, and asking a number of questions in respect of their practices 


and policies. 


RTL responded on 11 February 2019 with its response to the 
Commissioner’s initial queries. In brief, RTL explained that it uses 7 
CLIs (although the duration of this usage was neither requested, nor 
provided); that the data it used for the purposes of its direct marketing 
had been purchased “under contract” from two third party data 
providers; that consent was not recorded; that any due diligence 
checks were thought to have been carried out by the third party data 
providers and that there was accordingly no system in place to allow 
RTL to run the data against the TPS register or internal suppression 
lists. Furthermore, whilst there had been verbal communications with 
staff in respect of lawful contact with customers, no written procedures 


were in place. 


The correspondence did concede a level of naivety on the part of RTL, 
and advised of a willingness to work with the Commissioner to ensure 
future compliance. The correspondence also referenced a number of 
remedial measures that RTL intended to implement, including options 
for recording consent; the introduction of a pre-supplier contract to 
ensure the veracity of data being purchased; and the implementation 
of staff training and software to allow TPS-screening, amongst other 


changes. 
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The Commissioner issued a further letter on 12 February 2019 


requesting information in respect of these proposed changes, and 


copies of the existing contracts with the third party data providers. 


The subsequent response from RTL revealed that there were in fact no 
existing contracts, and instead provided a copy of a purchase order, 
and an invoice for data purchase, neither of which gave any written 
assurances to RTL as to any due diligence which had been carried out 


against the data. 


The response also failed to provide any additional information with 
regards to the proposed internal changes referred to in RTL’s earlier 
response of 11 February 2019, rather it was stated that RTL had now 
dismissed all staff, and that no further calls were being made. All 
training and induction of new staff had also been suspended. The 
response repeated the claim that the third party data providers were 
deemed to be a “competent source”, and therefore no checks on the 
data had been carried out by RTL. 


The Commissioner proceeded to serve a further 3PIN on the CSP on 25 
March 2019 to establish the volume of connected calls made from the 
10 CLIs the CSP had previously confirmed as being used by RTL over 


the relevant period. 


The figures provided to the Commissioner were then relayed to the TPS 
to establish how many of the numbers dialled belonged to subscribers 
who had been registered with the TPS, and the dates of their 


registration. 


In its response, the TPS confirmed that from the CLIs provided there 
had been 320,558 outbound calls made to subscribers, of which 
270,774 were made to subscribers who had been registered with the 
TPS for not less than 28 days at the time they received a call. 
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The Commissioner is satisfied that these 270,774 calls were all made 


for the purposes of direct marketing as defined by section 11(3) DPA. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by RTL and, if so, whether the 


conditions of section 55A DPA are satisfied. 

The contravention 

The Commissioner finds that RTL contravened regulation 21 of PECR. 
The Commissioner finds that the contravention was as follows: 


Between 1 January 2018 and 29 November 2018, RTL used a public 
telecommunications service for the purposes of making 270,774 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
This resulted in almost 100 complaints being made to the TPS and the 


Commissioner. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 270,774 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 


receiving the calls, and they had not given their prior consent to RTL to 
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receive calls. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by RTL arising from the organisation's activities over 
an 11 month period, and this led to a substantial number of unsolicited 
direct marketing calls being made to subscribers who were registered 
with the TPS, and a significant number of complaints being made as a 


result. 


The 270,774 unsolicited direct marketing calls made between 1 
January 2018 and 29 November 2018 were made from CLIs which 
were being used by RTL. This information has been obtained from RTL’s 
CSP and is reasonably relied upon by the Commissioner. These calls 
were not screened against the TPS register, nor is there any evidence 
of consent being provided to RTL from the individual subscribers. There 
is no evidence of any contractual terms between RTL and their data 
providers, or of any due diligence checks being carried out to ensure 
the veracity of the data being obtained. In short, RTL have failed to 
provide the Commissioner with any evidence to demonstrate an 


intention to comply with PECR. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 
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The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner does not consider that RTL deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether RTL knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 
She is satisfied that this condition is met, given that RTL relied 
apparently entirely on direct marketing due to the nature of its 
business, and the fact that the issue of unsolicited calls has been 
widely publicised by the media as being a problem. Given that it set 
out to embark on a direct marketing campaign, RTL should reasonably 


have sought to familiarise itself with the relevant legislation. 


The Commissioner has also published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
subscribers who have told an organisation that they do not want to 
receive calls; or to any number registered with the TPS, unless the 


subscriber has specifically consented to receive calls. 


The Commissioner’s direct marketing guidance also makes clear that 


organisations acquiring marketing lists from a third party must 
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undertake rigorous checks to satisfy themselves that the personal data 
was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. The 
Commissioner has been provided with no evidence that any such 
checks were undertaken, rather RTL claim to have been assured of the 
data’s veracity at the point of purchase but have failed to carry out any 
of their own checks. This would fail to satisfy the Commissioner’s 
requirement for due diligence, guidance for which is provided within 


the Commissioner’s publicly available Direct Marketing Guidance. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that RTL would have received a notification from the TPS for 
each of the complaints being made in this case. That there were 70 
complaints made to the TPS alone over the period of the contravention 
should have made RTL aware of the risk that such contraventions may 


occur, and were indeed occurring. 


It is therefore reasonable to suppose that RTL should have been aware 


of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether RTL 
failed to take reasonable steps to prevent the contravention. Again, she 
is satisfied that this condition is met. Reasonable steps in these 
circumstances may have included asking its third party data providers 
for evidence that the subscribers had consented to receiving calls from 
RTL, screening the data against the TPS register itself regardless of any 
assurances that might have been given by the providers of the data, 


and ensuring that it had in place an effective and robust suppression 
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list. Given the volume of calls and complaints, it is clear that RTL failed 


to take those steps. 


There is also no evidence that, prior to the Commissioner’s 
intervention, RTL sought to consult the Commissioner’s guidance, or to 
familiarise itself with the relevant legislation. By its own admission RTL 
did not seek to undertake any steps to ensure the integrity of the data 
it was purchasing, and has provided no evidence that the protection 
and privacy of subscribers was factored into the purchase of data with 
its providers. Additionally, it does not appear that there were any 
written policies in place for staff, nor was there was anything 
contractual in place between RTL and its data providers. RTL have 
explained these omissions away as ‘naivety’ on its part, however the 
Commissioner takes the view that such a reckless approach towards 
compliance with the law falls far short of the expected standard, and 


cannot be said to be anything other than negligent. 


The Commissioner takes the view that RTL failed to take reasonable 


steps to prevent the contravention. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following aggravating 


features of this case: 


The complaints received via the Commissioner’s ORT and the TPS 


demonstrate that subscribers suffered rude, antagonistic and potentially 
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intimidating behaviour from the callers, which is likely to have added to 


the level of distress suffered; 


The lack of any kind of internal suppression list suggests that repeated 


calls could have been made to subscribers. 


The Commissioner has taken into account the following mitigating 


feature of this case: 
The company has since ceased its live marketing calls. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by RTL on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 


concern. A monetary penalty in this case should act as a general 
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encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 


to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


For these reasons, the Commissioner’s has decided to issue a monetary 
penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £80,000 (eighty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 3 September 2020 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
2 September 2020 the Commissioner will reduce the monetary 
penalty by 20% to £64,000 (sixty four thousand pounds). 
However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 
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There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 34 day of August 2020. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2: If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Email: grc@justice.gov.uk 
Telephone: 0300 123 4504 


a) 


b) 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state: - 


a) 


b) 


c) 


d) 


e) 


f) 


g) 


h) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeala copy of the 


monetary penalty notice or variation notice; 


if you have exceeded the time limit mentioned above the notice 
of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 
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Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 


20 


